Bcrypt Hash + Verify

Bcrypt is a deliberately slow password-hashing algorithm: unlike MD5 or SHA-256, it intentionally requires heavy computation so that brute-forcing passwords stays impractical even if a database of hashes leaks.

How to use it

• Hash: enter a password and set a cost factor — a higher number means slower, more secure hashing.
• Every hash call generates a fresh random salt, so the same password produces a different hash each time — that's expected and normal.
• Verify: paste a password and an existing bcrypt hash to check whether they match, without hashing manually yourself.

Common uses

• Manually checking that a backend hashes passwords correctly before storing them.
• Generating a test bcrypt hash for seed data or fixtures during development.
• Debugging a failed login by comparing an entered password against the stored hash.

Things to keep in mind

Pick a cost factor that keeps hashing around 100-300ms on your target server — a balance between security and login-time load.

Bcrypt truncates passwords longer than 72 bytes — characters beyond that limit are ignored by the algorithm.